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Synopsis:  Set  lead  for  Legat  to  contact  service  providers  to  determine 

identity  of  individual  using  IP  addresses. 


Administrative:  Reference  telcall  between  SSA[ 

Diego  and  SAl  ~ 


|  of  San 

PENTTBOMB  Team,  FBIHQ,  on  4/16/2002. 


Details:  At  approximately  3:45  p.m.  on  September  12,  2001,  the 

Washington  Field  Office  of  the  FBI  was  notified  by  the  Dulles  Airport 
Police  that  a  suspicious  vehicle  was  found  at  the  Dulles  International 
Airport  located  in  the  Hourly  Lot,  Row  G,  Dulles,  Virginia.  Department  oi 
Motor  Vehicle  records  were  reviewed  by  FBI  agents  from  the  Washington 
Field  Office  and  determined  the  1988  Toyota  Corolla,  with  California 
license  plates,  Vehicle  Identification  Number  JT2AE92E9J3137546 ,  was 
registered  to  Nawaf  Al-Hazmi,  of  8451  Mount  Vernon  Avenue,  Lemon  Grove, 
California . 


The  vehicle  was  searched  by  agents  of  the  FBI  and  found  to _ 

r^rvnt-a-in  a  mpHipal _ licescription  for  Khalid  Al-Mihdhar  froml  1 

_ l  California,  a  receipt  for  car  service  at 

|  San  Diego,  California,  signed  by  Khalid  Al- 
Mihdhar,  and  an  insurance  card  under  the  name  of  Khalid  Al-Mihdhar,  7091 
Eskstrom  Avenue,  San  Diego,  California.  Subsequent  investigation  in  San 
Diego  confirmed  that  both  Al-Hazmi  and  Al-Mihdhar  resided  in  San  Diego  ir 
1999  and  2000. 

ALL  INFORMATION  CONTAINED 
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On  September  13,  2001,  FBI  agents  from  the  San  Diego  Field 
Office  interviewed  flight  instructors  at  the  Sorbi  Flight  Club  which  is 
located  at  the  Montgomery  Airfield,  San  Diego,  California.  According  to 
the  flight  instructors,  in  May  of  2000,  Al-Hazmi  and  Al-Mihdhar  began 
taking  flying  lessons  with  the  Sorbi  Flight  Club.  Al-Hazmi  and  Al-Mihdhc 
expressed  a  strong  interest  in  flying  Boeing  and  jet  aircraft.  Al-Hazmi 
and  Al-Mihdhar  were  instructed  that  they  would  have  to  learn  to  fly 
smaller  single  engine  aircraft  first.  Al-Hazmi  and  Al-Mihdhar  took 
kg  approximately  six  flying  lessons  at  the  Sorbi  Flight  Club.  Al-Hazmi  and 
}■) 7 c  Al-Mihdhar  were  mainly  preoccupied  with  learning  to  control  the  aircraft 
while  airborne  and  took  no  interest  in  takeoffs  and  landings  and  made 
little  effort  to  improve  those  flying  skills. 


listed  on  the  lease  at  that  time  but  were  preparing  to  move  out. 

I  _ I  said  that  in  December  2000  he  moved  into  a  residence  located 

atl  lafter  Al-Hazmi  and 

Al-Mihdhar  moved  out  of  the  residence. 


On  September  15,  2001, 


granted  Special  Agents  of 


the  FBI  consent  to  search  his  room  and  his  home  computer  at  the 
I  I  The  San  Diego  Regional  Computer  Forensics 

Laboratory  ( " RCFL" )  subsequently  performed  a  forensic  analysis  of 
|  | computer .  The  RCFL  uncovered  several  web  pages  on  the 


computer's  hard  drive  which  expressed  strong  anti-American  sentiments. 
These  web  pages  contained  headlines  such  as  "America's  Campaign  to  Destrc 
Islam,"  "U.S.  &  Britian  Kill  Muslim  Children  In  Genocide  Attempt,"  and  "1 
Message  From  Bin  Laadin[sic]:  Declaration  of  War."  There  were  also  severs 
web  pages  in  support  of  the  Muslims  and  their  war  against  the  Russians  ir 

Chechnya.  Digital  records  from _ computer  revealed  the  email 

address  MOHDAR78@HOTMAIL.COM. 


Investigation  at  Grossmont-Cuyamaca  Community  College  District, 
8800  Grossmont  College  Drive,  El  Cajon,  California  by  the  FBI  revealed 
that  the  email  address,  MOHDAR78@HOTMAIL.COM,  was  provided  by  Mohdar 
Abdullah  as  a  point  of  contact. 
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On  September  19,  2001,  Special  Agents  from  the  FBI  interviewed 
Mohdar  M.  Abdullah  of  1415  E.  Lexington  Avenue,  Apartment  Number  146,  El 
Cajon,  California  regarding  his  association  with  Al-Hazmi  and  Al-Mihhhar. 
Abdullah  related  that  he  met  Al-Hazmi  and  Al-Mihdhar  in  1999  in  San  Diegc 
California.  Omar  Al-Bayoumi  asked  Abdullah  to  become  acquainted  with  Al- 
Hazmi  and  Al-Mihdhar  and  to  acclimate  them  the  area  and  assist  in  any  waj 
in  their  affairs.  Abdullah  assisted  Al-Hazmi  and  Al-Mihdhar  in  arranging 
travel  arrangements  and  flight  lessons  while  in  San  Diego,  California.  Ir 
early  2001,  Al-Hazmi  telephonically  contacted  Abdullah  and  informed  him 
that  Al-Hazmi  was  in  Arizona  attending  flight  school. 

On  September  21,  2001,  a  Federal  material  witness  warrant, 
pursuant  to  Title  18,  United  States  Code,  Section  3144,  was  issued  in  the 
Southern  District  of  New  York  for  Abdullah's  detention.  On  September  21, 
2001,  Abdullah  was  arrested  as  a  material  witness  in  San  Diego,  Californj 
and  transferred  to  New  York  on  September  25,  2001. 


On  October  5,  2001,  Abdullah  was  interviewed  by  Agents  of  the 
FBI  in  conjunction  with  a  Grand  Jury  investigation  in  the  Southern 
District  of  New  York.  Abdullah  was  shown  and  acknowledged  writing  a 
document  that  contained  references  to  Stinger  anti-tank  weapons, 
"martyrs,"  "mortors,",  and  "grenade  launchers."  Abdullah  further  explains 
that  the  document  reflected  his  interest  in  weaponry,  which  was  spawned 
through  his  relationship  with  an  individual  named 


had  utilized  an  indoor 


Abdullah  advised  that  he  and 
shooting  range  in  El  Cajon,  California 
Abdullah  and  attended  the  A1  Ribat  mosque  in  the  San  Diego  area 


also  knew 
the  United  States  Navy. 


~~H°f 

Abdullal" 

and  stated  that  he  was  a  veteran  of 


Subsequent  investigation_saLi-Lh  <~ba  Uni  i-e-d  states  Navy  has 


revealed  that  an  individual  named 


in  the  Navy  and  had  received  small  arms  weapons  training. 


was  previously  enlisted 


On  September  2 2  2  001 

Federal  search  warrant  at 
Subsequent  to  the  search, 
addr e  s  s ,  | 


Special  Agents  of  the  FBI  executed  a 


a  computer  was  identified  by  a  resident  of  the 
]  as  having  been  used  frequently  by  Abdullah. 


A  separate  Federal  search  warrant  was  acquired  for  this 
computer,  which  was  then  forensically  reviewed  by  the  RCFL .  Located  on 
this  computer  was  an  email  message  dated  August  12,  2001,  from[ 


AL1AKUM  FROM  KANSAS  CITY. 


with  the  subject  line  "SALAAM  U 
URGENT  RESPONSE  NEEDED..”  In  the  message, 


said  "PLEASE  TALK  TO  THE  BROTHERS  IN  SAN  DIEGO  AS  MANY  AS  Y  OU  CAI 
COLEN  POWELL  STATED  TODAY  THAT  THE  US  WAS  COMMITED  TO  MOVING  THE  EM  BASS^i 
TO  JERUSELEM  WE  MUST  ORGANIZE  A  MASSIVE  PROTEST  OF  THI  S  STANCE  WE  NEED 
PRESS  COVERAGE."  The  message  was  sent  tcj  Furthe 
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investigation  revealed  that  numerous  individuals  used  the  seized  compute; 
to  perform  a  myriad  of  functions,  including  checking  email. 


Special  Agent 


advised  that  based  on  discussion 


with  agents  working  Domestic  ana  international  Terrorism,  the  alleged 
terrorists  involved  in  the  attacks  on  the  World  Trade  Center  Towers  and 
Pentagon  collaborated  and  communicated  with  a  network  of  individuals  an$ 
organizations  to  facilitate  their  attacks.  It  is  believed  that  they  usee 
the  Internet,  including  email  accounts  to  communicate  with  associates. 


FBI  analysis  of  the  business  records  and  email  activity 
obtained  in  the  investigation  to  date  indicates  that  some  of  the  19 
suspected  hijackers  used  the  internet  to  further  their  criminal  conduct. 
For  example,  at  least  12  of  the  suspected  hijackers  purchased  airline  anc 
other  tickets  over  the  internet  using  email  and  giving  email  addresses  at 
contact  and  confirmation  points  for  their  reservations.  The  tickets  for 
the  hijacked  flights  that  were  purchased  using  email  addresses  were  all 
purchased  between  August  25  and  August  29,  2001,  further  indicating  that 
the  hijackers  had  closely,  and  secretly,  communicated  to  coordinate  theii 
scheme . 


account , 

0 1  / 1 8  /  2  0  [5T7 


troi 


Upon  reviewing  the  contents  of  MSN  Hotmail 

agents  of  the  FBI  discovered  an  email  dated 

_ | that  contained 

statements  relating  to  possible  terrorist  activities.  The  communication 


contained,  in  part,  the  following  statements: 

"before,  our  plan  was  to  go  to  the  U.S,  we  would  have  a  few 
people  ready  to  plant  bombs  in  very  important  buildings" 

The  communication  specifies  as  targets;  the  White  House,  NASA,  the  UN 
Headquarters  and  the  Canadian  Parliament  Building,  among  others.  It  goes 
on  to  say  that  "All  this  sounds  impossible,  but  anything  is  possible". 

The  author  finally  directs  the  recipients  of  the  email  to  respond  to  the 


account 


J and  tell  him  what  they  think  of  the  plan. 


A  2703 (d) 
relating  to  the  account 
the  account  was  accessed 
a  record  of  every  login 


Court  Order  was  served  on  MSN  Hotmail  for  records 

|  The  results  showed  that 
trom  a  numoer  or  ip  addresses.  MSN  Hotmail  keej 
to  a  Hotmail  account  and  what  IP  address  was  usee 


for  that  login.  An  IP  address  is  a  unique  number  assigned  to  each 
computer  on  the  Internet.  The  physical  equivalent  would  be  a  telephone 
number  with  country  and  area  code.  The  subscriber  records  can  be  obtains 
for  an  IP  address  just  as  with  a  telephone  number. 


The  following  IP  addresses  were  used  to  access  the 
laccount  at  the  times  listed: 
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ses  used  to  access  the  Hotmail  account 
i s  owned  by : 

address  block 

for 

The 


is  owned  by: 


■be 

b7C 


The  above  list  points  of  contact  can  be  contacted  to  determine 
the  identity  of  the  person  using  each  IP  address  at  the  specified  date  ar 

time. 


) 
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LEAD (s) : 

Set  Lead  Is 

OTTAWA 

AT  OTTAWA 

Liaison  with  Canadian  officials  to  have  the  following  companie 
contacted  to  determine  the  identity  of  the  individual  who  used  the  IP 
addresses  at  the  specified  dates  and  times: 


All  IP  addresses  beginning  with 
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All  IP  addresses  beginning  with 


♦♦ 
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